This invention is related to controlling access in networks, and more specifically, to controlling access of a wireless client to a network in an IEEE 802.1x regime.
The IEEE (Institute of Electrical and Electronic Engineers, Inc) 802 Local Area Network standards provide guidelines for allowing users to physically connect to a network and access basic services provided therein. However, it has become more evident in recent years that controlled access is a necessity with the large amount of sensitive information that is communicated over networks of virtually any size. Access can be restricted by any number of methods, including user logins and passwords, network identification of a unique identification number embedded within the network interface card, call-back schemes for dial-up access, and others.
In an IEEE 802.3 network, such conventional wired network access protection schemes can be easily defeated since encryption is not used between network devices. Thus the use of a switch or bridge as an access point for protecting against unauthorized network access in a wired regime can be problematic. For example, if a switch port was made physically available in a conference room for connection thereto by a first wireless user having a laptop, connection to the local network would then be established through the switch. Network access for the wireless user is granted only through that switch port upon successful authentication. However, a problem with this implementation is that simply connecting a hub to the LAN between the switch and the access point can easily defeat it. Once the first wireless user connects to the LAN through a port of the hub, and is properly authenticated on the switch port, a second wired user could then plug-in to one of the hub ports and gain access to the network, since the switch port has authenticated the first user, and does not care about the other connected and unauthenticated users so long as the first wireless user provides authentication traffic to the switch.
The IEEE 802.1x standard offers an additional method for controlling network access utilizing port control. Port-based network access control makes use of the physical access characteristics of an IEEE 802 LAN infrastructure in order to provide a means of authenticating and authorizing devices attached to a switch port that has point-to-point connection characteristics. Thus in existing IEEE 802.1x implementations, when a network device designed as an access point (AP) comes online, the AP authenticates through the switch to an authentication server. When properly authenticated, the switch port becomes “opened” up for that authenticated AP. However, in this port-control implementation, since the port has been opened for the authenticated AP, any other unauthenticated client can now also connect through that AP and gain full access to the network. Such port authorization related to switches, bridges and routers needs to be made more secure since such network devices form the switch fabric that provide interconnectivity between the extensive number of networks in existence today. It would be advantageous, however, to have greater control over the use of device ports.
What is needed, instead of port control, is to provide more extensive control between wired and wireless entities, such that the trust relationship is extended beyond the access point to a wireless client. Once properly authenticated, the PC client is then established as a trusted client, insofar as the switch is concerned, and the information communicated between the wireless PC client and the switch is passed through the AP unimpeded and unaltered.